MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fbdf3aed799b476ec4a89b100195efd05bcbc7d51728dd2415ce2c506b4b72cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

HawkEye

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	fbdf3aed799b476ec4a89b100195efd05bcbc7d51728dd2415ce2c506b4b72cf
SHA3-384 hash:	bc92d18ce6d116d8e8a54ae5331c22ae3b667996bd44d956e64f4d6bcec3fc17e2234954105a0c700fe62f7ed90cf088
SHA1 hash:	43359f13d607bcfd0002aceefff341a863b81ba6
MD5 hash:	596dd45a5b48ef45e4cae443d7314f35
humanhash:	east-four-fillet-edward
File name:	CURE FOR CORONAVIRUS_pdf.exe
Download:	download sample
Signature	HawkEye Create hunting rule
File size:	2'258'432 bytes
First seen:	2020-04-06 08:55:52 UTC
Last seen:	2020-04-06 08:55:54 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep	49152:+w80cTsjkWaxUPWYqpq93kdHAoXoQnlnU/HHP:D8sjkyP6K8HA/f
Threatray	7'164 similar samples on MalwareBazaar
TLSH	6EA5F12273DDC360CB6E5173BF69B3452E7B38654134B87B1EB80D78A9501621E2C6AF
Reporter	abuse_ch
Tags:	COVID-19 exe HawkEye

Intelligence

File Origin

# of uploads :

# of downloads :

116

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.27686.AidExe.UNOFFICIAL

Sanesecurity.Malware.27684.AidExe.UNOFFICIAL

SecuriteInfo.com.Trojan.PWS.Stealer.19347.UNOFFICIAL

Gathering data

Threat name:

Script-AutoIt.Trojan.Injector

Status:

Malicious

First seen:

2020-04-06 02:24:15 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

28 of 31 (90.32%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=7pptv3lztndw5rfitmiadfpp2bn4xr6vc4un2javzywfa22lolhq._file

Verdict:

malicious

Label(s):

hawkeyekeylogger

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

gz 0fc9ab3101131dda155393a792474504de189da12547e351254e37ab5fbba32d

HawkEye

exe fbdf3aed799b476ec4a89b100195efd05bcbc7d51728dd2415ce2c506b4b72cf

(this sample)

Dropped by

SHA256 0fc9ab3101131dda155393a792474504de189da12547e351254e37ab5fbba32d

Dropped by

MD5 322bee81a4b68a772c146f8ab36a8547

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	ADVAPI32.dll::AllocateAndInitializeSid ADVAPI32.dll::CopySid ADVAPI32.dll::FreeSid ADVAPI32.dll::GetLengthSid ADVAPI32.dll::GetTokenInformation ADVAPI32.dll::GetAce
COM_BASE_API	Can Download & Execute components	ole32.dll::CLSIDFromProgID ole32.dll::CoCreateInstance ole32.dll::CoCreateInstanceEx ole32.dll::CoInitializeSecurity ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_API	Can Play Multimedia	WINMM.dll::mciSendStringW WINMM.dll::timeGetTime WINMM.dll::waveOutSetVolume
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AddAce ADVAPI32.dll::AdjustTokenPrivileges ADVAPI32.dll::CheckTokenMembership ADVAPI32.dll::DuplicateTokenEx ADVAPI32.dll::GetAclInformation ADVAPI32.dll::GetSecurityDescriptorDacl
SHELL_API	Manipulates System Shell	SHELL32.dll::ShellExecuteExW SHELL32.dll::ShellExecuteW SHELL32.dll::SHFileOperationW
WIN32_PROCESS_API	Can Create Process and Threads	ADVAPI32.dll::CreateProcessAsUserW KERNEL32.dll::CreateProcessW ADVAPI32.dll::CreateProcessWithLogonW KERNEL32.dll::OpenProcess ADVAPI32.dll::OpenProcessToken ADVAPI32.dll::OpenThreadToken
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::SetSystemPowerState KERNEL32.dll::LoadLibraryA KERNEL32.dll::LoadLibraryExW KERNEL32.dll::LoadLibraryW KERNEL32.dll::GetDriveTypeW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CopyFileExW KERNEL32.dll::CopyFileW KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateHardLinkW IPHLPAPI.DLL::IcmpCreateFile KERNEL32.dll::CreateFileW
WIN_BASE_USER_API	Retrieves Account Information	KERNEL32.dll::GetComputerNameW ADVAPI32.dll::GetUserNameW ADVAPI32.dll::LogonUserW ADVAPI32.dll::LookupPrivilegeValueW
WIN_NETWORK_API	Supports Windows Networking	MPR.dll::WNetAddConnection2W MPR.dll::WNetUseConnectionW
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegConnectRegistryW ADVAPI32.dll::RegCreateKeyExW ADVAPI32.dll::RegDeleteKeyW ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryValueExW ADVAPI32.dll::RegSetValueExW
WIN_USER_API	Performs GUI Actions	USER32.dll::BlockInput USER32.dll::CloseDesktop USER32.dll::CreateMenu USER32.dll::EmptyClipboard USER32.dll::FindWindowExW USER32.dll::FindWindowW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample